Steve Poirot wrote:
> I'm 98% sure that the key pair is generated on the client machine and
> that just the public key is transmitted to the CA. The reason I say 98%
> instead of 100% is that it's possible that a CA just makes it look like
> that's what's happening. This could be verified by sniffing the session.
Well, the amusing thing is you can do it either way. As it happens
neither Thawte nor Verisign (yeah, OK, they're the same thing) have sold
out enough to generate private keys.
I still hear people telling me occasionally that there are sound reasons
for having the CA generate the private key. Strangely they never quite
get round to specifying what those reasons are.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html http://www.thebunker.net/
"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
Received on May 10 2003
Intro
